Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-08-01T12:22:17 FreeRDP: FreeRDP: Denial of Service via null pointer dereference in smartcard cleanup 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CWE-476

FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard device control request cleanup when reader-state decoding fails. Attackers can send malformed smartcard IRP requests with non-zero cReaders and truncated reader-state data to crash the process via null pointer access in free_reader_states functions.

A null pointer dereference flaw in FreeRDP allows a remote attacker to cause a denial of service (DoS) via specially crafted smartcard requests. If reader-state decoding fails, the system attempts to free uninitialized states during cleanup, resulting in a process crash.

This Moderate-impact vulnerability causes a denial of service (DoS) in FreeRDP clients and proxies. If smartcard redirection is enabled, an attacker (via a malicious server or proxy client) can send specially crafted smartcard IRP requests to trigger a null pointer dereference during cleanup. Note: FreeRDP packages shipped in Red Hat Enterprise Linux (RHEL) 9 and older are not affected. To mitigate this issue, disable smartcard redirection in FreeRDP client configurations if smartcard functionality is not required. This can typically be achieved by launching the `xfreerdp` client without the `/smartcard` option, or by explicitly setting `/smartcard:no` if a configuration file is used. Disabling smartcard redirection will prevent the use of smartcard devices with FreeRDP sessions. Red Hat Enterprise Linux 10 Affected freerdp Red Hat Enterprise Linux 6 Not affected freerdp Red Hat Enterprise Linux 7 Not affected freerdp Red Hat Enterprise Linux 8 Not affected freerdp Red Hat Enterprise Linux 9 Not affected freerdp https://www.cve.org/CVERecord?id=CVE-2026-67304 https://nvd.nist.gov/vuln/detail/CVE-2026-67304 https://github.com/FreeRDP/FreeRDP/commit/1cc783d4c78bd2f66d3a8582dfe70a663d141444 https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-78jj-45vh-jpm5 https://www.vulncheck.com/advisories/freerdp-before-null-dereference-via-smartcard-cleanup